CVE-2026-106000

The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying...

CVE-2026-106000

The Booking Package WordPress plugin, in versions prior to 1.7.34 , contains an unauthenticated payment bypass vulnerability. The software fails to verify that a payment has been completed before saving a booking on calendars configured to require online payment. This allows unauthenticated users...

EUVD-2026-116713

The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying...

bitwarden-cipher-create-acl

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · bitwarden-cipher-create-acl Write-up: https://abraxaslabs.tech/research/bitwarden-cipher-create-acl bitwarden-cipher-create-acl Bitwarden Server v2026.9.2 - Bitwarden Org cipher create on the Entity Framework path...

CVE-2026-105256

The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed...

PT-2026-120502

The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed...

CVE-2026-111367 BillionMail through 4.9 Forgeable JWTs via Default Signing Key

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribene...

CVE-2026-111367 BillionMail through 4.9 Forgeable JWTs via Default Signing Key

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribene...

CVE-2026-111367 BillionMail through 4.9 Forgeable JWTs via Default Signing Key

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribene...

CVE-2026-59177

creationtimestamp| type| source ---|---|--- 2026-09-15 09:00:13+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-59177.yaml 2026-10-28 13:22:24+00:00| seen| https://infosec.exchange/users/cve/statuses/117518745205641994...

CVE-2026-62382

creationtimestamp| type| source ---|---|--- 2026-09-15 09:00:05+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-62382.yaml 2026-09-16 00:00:03+00:00| confirmed|...

CVE-2025-57231

creationtimestamp| type| source ---|---|--- 2026-09-14 21:00:06+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-57231.yaml 2026-09-15 00:00:06+00:00| confirmed|...

CVE-2026-89587

In the Linux kernel, the following vulnerability has been resolved: ACPI: pfrupdate: fix stack buffer overflow in querycapability querycapability copies four ACPI buffer objects returned by the firmware DSM into fixed-size u816 fields in struct pfruupdatecapinfo using memcpy with the...

UBUNTU-CVE-2026-89587

In the Linux kernel, the following vulnerability has been resolved: ACPI: pfrupdate: fix stack buffer overflow in querycapability querycapability copies four ACPI buffer objects returned by the firmware DSM into fixed-size u816 fields in struct pfruupdatecapinfo using memcpy with the...

CVE-2026-89587 ACPI: pfr_update: fix stack buffer overflow in query_capability()

In the Linux kernel, the following vulnerability has been resolved: ACPI: pfrupdate: fix stack buffer overflow in querycapability querycapability copies four ACPI buffer objects returned by the firmware DSM into fixed-size u816 fields in struct pfruupdatecapinfo using memcpy with the...

CVE-2026-87820

creationtimestamp| type| source ---|---|--- 2026-09-10 06:00:06+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-87820.yaml 2026-09-11 00:00:04+00:00| confirmed|...

CVE-2026-0561

creationtimestamp| type| source ---|---|--- 2026-09-07 03:00:42+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-0561.yaml 2026-09-08 00:00:03+00:00| confirmed|...

X Money rollout linked to password-reset attacks

X says attackers may be targeting accounts because its X Money payments service is now more widely available. The company is investigating a wave of unsolicited password-reset emails sent to users. While their arrival alongside the wider X Money rollout has fueled account-takeover concerns, X say...

CVE-2026-57582

creationtimestamp| type| source ---|---|--- 2026-09-02 03:00:06+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-57582.yaml 2026-09-03 12:00:05+00:00| confirmed|...

CVE-2026-80563

CVE-2026-80563 is a use-after-free in the Linux kernel's gpio-sloppy-logic-analyzer platform driver. The trigger debugfs file's trigger_write() handler dereferences a per-device structure allocated via devm_kzalloc(). Because the file was created with debugfs_create_file_unsafe(), the full_proxy ...